A sophisticated China-linked advanced persistent threat (APT) group has deployed a previously unknown backdoor malware targeting critical infrastructure and government networks across Southeast Asia. The campaign, active since late 2023, demonstrates advanced tradecraft including custom tooling, liv
The notorious Russian-language cybercrime forum XSS.is has been shut down, removing a major marketplace where ransomware operators, initial access brokers, and malware developers converged. Despite this significant disruption, the ransomware ecosystem shows remarkable resilience as actors migrate to
Citrix has patched a critical vulnerability in NetScaler ADC and Gateway appliances that shares alarming similarities with the infamous CitrixBleed exploit. CISA has added this flaw to its Known Exploited Vulnerabilities catalog, signaling active or imminent exploitation. Organizations running affec
A newly disclosed prompt injection attack dubbed “BioShocking” exploits AI-powered browsers to bypass safety mechanisms and execute unauthorized actions including data exfiltration, credential theft, and malicious navigation. The technique leverages carefully crafted prompts that manipulate the AI a
Microsoft security researchers have uncovered a critical attack vector where threat actors poison Model Context Protocol (MCP) tool descriptions to manipulate AI agents into exfiltrating sensitive data. This novel technique exploits how AI agents interpret natural language instructions embedded in t
Attackers are actively exploiting a remote code execution (RCE) vulnerability in Langflow, a popular low-code AI application development platform, to deploy XMRig cryptocurrency miners on exposed instances. The exploitation targets publicly accessible Langflow endpoints, leveraging insecure configur
Business Email Compromise (BEC) attacks have evolved from opportunistic scams into sophisticated operations powered by underground criminal networks. Recent investigations reveal coordinated ecosystems where specialized actors trade compromised credentials, corporate intelligence, and money launderi
AI-powered video surveillance systems now allow operators to search footage using natural language queries like “show me everyone wearing a red jacket” or “find people meeting in parking lots after 10 PM.” This technology, deployed across cities worldwide, transforms massive video archives into sear
GitHub’s Advisory Database has reached unprecedented volume levels, with vulnerability submissions now exceeding the platform’s review capacity. The backlog has created significant delays in security advisory publication, potentially leaving thousands of open-source projects vulnerable while maintai
A critical authentication bypass vulnerability in SimpleHelp remote support software (CVE-2024-48558) is being actively exploited by threat actors to deploy TaskWeaver malware and the Djinn information stealer. The flaw allows unauthenticated attackers to gain unauthorized access to systems running